1Z0-116: Oracle Database Security AdministrationDemo

DBMS_MACUTL.G_RULESET_EVAL_ANY makes the rule set evaluate to true when at least one included rule is true. A PASSWORD-authenticated user fails the authentication-method rule and therefore can connect only when the time rule is true—outside 09:00 through 17:00. A user not authenticated with PASSWORD satisfies the authentication-method rule at any time, so the time-based restriction does not affect that user's ability to connect. Oracle Database Vault allows a command rule when its associated rule set evaluates to true.

Oracle Transparent Sensitive Data Protection's predefined REDACT_AUDIT policy masks bind-variable values for sensitive columns. The masked values appear as asterisks in audit records, trace files, and queries of the V$SQL_BIND_DATA view.

SQLNET.ALLOWED_LOGON_VERSION_SERVER=8 permits the 10G, 11G, and 12C password versions. This preserves authentication for accounts retaining Oracle 10g password verifiers after an upgrade, whereas the Oracle Database 19c default server setting of 12 excludes the 10G password version.

Oracle audit trails contain a client-identifier attribute for the database session, so a client identifier associated with audited activity is recorded in the audit trail. A session has a single current client identifier, and an application can set or change it; SQL*Net does not automatically set it. Oracle documents the CLIENT_IDENTIFIER audit-trail field in the UNIFIED_AUDIT_TRAIL view.

directory_name => 'DATA_PUMP_DIR' designates the directory that holds the target database cwallet.sso; DATA_PUMP_DIR is the default directory for this parameter. credential_name => 'DB_LINK_CRED' refers to a stored credential created with DBMS_CLOUD.CREATE_CREDENTIAL, which provides the target database username and password. The port is the target listener port and is not restricted to 1521; wallet files can also be stored in user-defined directories.

SESSION_USER is the identity that authenticated at logon and remains constant throughout the session. CURRENT_SCHEMA can be altered, CLIENT_INFO is application-set session information, and CURRENT_USER can change with active privileges such as those of a definer's-rights program unit.

LOCKED(TIMED) indicates that consecutive failed logins exceeded the FAILED_LOGIN_ATTEMPTS profile limit and the account remains under its timed lock period (PASSWORD_LOCK_TIME). A password lifetime expiration would produce an expired status rather than LOCKED(TIMED).

For Oracle TDE column encryption, encrypted columns within the same table must use a matching encryption specification, including the encryption algorithm. Oracle permits decrypting an encrypted column with ALTER TABLE ... MODIFY, so encryption is not irreversible.

In an Oracle Database Vault environment, DBMS_MACADM.AUTHORIZE_DATAPUMP_USER provides Database Vault-specific authorization but does not grant the standard Oracle Data Pump privileges. The Data Pump user or an enabled role must also have EXP_FULL_DATABASE (and, generally, IMP_FULL_DATABASE for import operations). Granting EXP_FULL_DATABASE to CRMMGR supplies the missing export privilege. DV_OWNER is required for a full database export or import, not for this table export.

A Real Application Security data policy is associated with a particular table or view rather than automatically inherited by views created on the table. The object owner can create another view over the same table and assign that view a different RAS policy. With owner_bypass disabled, the owner of the protected EMPLOYEES object cannot bypass EMP_POLICY.

DBSAT Discoverer permits literal column-name matches through COL_NAME_PATTERN regular expressions, assigns findings to configured sensitive categories with High, Medium, or Low risk levels, and supports an exclusion-list file for excluding schemas, tables, or columns from discovery scans. Its patterns apply to column names and comments rather than scanning every row’s column values, and it produces a separate Database Sensitive Data Assessment Report.

Database Vault enforces separation of duties by reserving account-management actions, including CREATE USER, for the DV_ACCTMGR role. Other roles, including the traditional DBA role, cannot use that capability; Database Vault is not implemented by dropping the DBA role or by removing the privilege from DV_ACCTMGR.

Oracle Database requires password-file authentication for a privileged connection over a nonsecure remote connection. A privileged connection over a secure remote connection may also use password-file authentication; the alternative is operating-system authentication. NTS and BEQ use native operating-system authentication, while SQLNET.AUTHENTICATION_SERVICES=(NONE) enables normal database username/password authentication rather than requiring a password file.

ALTER DATABASE DICTIONARY ENCRYPT CREDENTIALS encrypts sensitive credential data held in data-dictionary tables, including the credentials associated with database links in SYS.LINK$. It does not encrypt the password file, PL/SQL code, cached SQL, or all database-user credentials.

DBMS_REDACT.FULL fully redacts a column’s value. Oracle Data Redaction displays the default full-redaction value of 0 for numeric data types, including a salary column. Oracle Data Redaction: Full Data Redaction

REJECTED disables the encryption security service even when the other side requests it. Therefore, a client setting of REQUESTED combined with a server setting of REJECTED disables encryption and data negotiation.

Oracle Data Masking and Subsetting can apply subsetting rules and masking rules together during an in-export operation, writing only masked, subsetted data to Oracle Data Pump dump files for import into a test database. RMAN creates physical copies and does not provide that integrated operation.

Oracle Database security vulnerabilities can be addressed by upgrading, applying the relevant Release Update or Release Update Revision, or using a workaround provided by Oracle Support. Oracle may also deliver a one-off (interim) patch for a specific defect, version, and platform; requesting a “one-off patch exception” is not a defined remediation method. Oracle documents that Release Updates include security fixes and that one-off patches are delivered on request for a specific defect/version/platform combination.

In SQL*Plus, ACCEPT ... HIDE prevents the entered password from being echoed, and SET VERIFY OFF prevents substituted command text from being displayed. Together, these settings keep the password out of screen output and spool files.

DBSAT Collector writes the collected assessment data to a JSON file. Its no-encryption option (-n) disables protection of that output rather than producing one of the Reporter’s HTML, text, or Excel report formats.

The SYSBACKUP administrative privilege supports backup and recovery operations and permits connection to the database even when the database is not open. It can use password-file authentication, rather than requiring operating-system authentication.

Transparent Data Encryption protects database files at rest by encrypting stored data and log files.

A privilege captured at runtime is saved under the runtime capture name. Database Privilege Analysis is an Oracle Database Enterprise Edition capability and does not require enabling the Database Vault option or extra database configuration after installation. It supports precompiled database objects, removes relevant capture values when an object is dropped, and does not recommend which grant path to retain.

In SQL*Plus, the HIDE clause of ACCEPT suppresses the characters entered for a password, and SET VERIFY OFF suppresses substitution-variable verification output. This prevents the prompted password from being exposed in displayed or spooled output.